annotate pirelli/calypso @ 162:8d30e1722e0f

locked C139 bootloader reverse-engineered
author Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
date Thu, 15 May 2014 20:55:39 +0000
parents 8e4dac492552
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
54
8e4dac492552 another Pirelli PCB tracing session, focusing on the display subsystem
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents: 10
diff changeset
1 BGA orientation: A1 is the LR corner in steve-m's L1 picture. Row A is on the
8e4dac492552 another Pirelli PCB tracing session, focusing on the display subsystem
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents: 10
diff changeset
2 bottom; row P is on the top; column 1 is on the right; column 14 is on the left.
8e4dac492552 another Pirelli PCB tracing session, focusing on the display subsystem
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents: 10
diff changeset
3
10
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
4 Calypso pin I thought was nIBOOT (N1), but actually seems to be A13 (RFEN):
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
5 the trace from the ball goes straight down to a via, L1 image coords
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
6 (3676,1174). On L2 trace goes to another via at (3234,1074). On L5 it goes
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
7 to yet another via at (2950,535). On L4 it goes to (1941,457). On L2 it goes
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
8 to a surface via at (1957,484). Back on L1 it goes to Rita pin 2 (XEN).
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
9 This arrangement matches what the Rita spec describes as the "external VCTCXO"
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
10 configuration. In contrast, the Leonardo schematics depict the "internal
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
11 VCTCXO" configuration.
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
12
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
13 Double-checking: in the "external VCTCXO" configuration Rita pin 1 (XSEL) is
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
14 supposed to be grounded. On L1 the pad appears to go nowhere (isolated).
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
15 The central coordinates of the pad on L1 are (1956,638). On L2 there is
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
16 solid copper fill in that area. Perhaps there is an invisible micro-via?
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
17
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
18 The real nIBOOT pin (N1): stays on L1, a trace takes it to one pad of a
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
19 2-pad SMT component, the other pad's connection is unclear (appears isolated,
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
20 must be an invisible micro-via). Must be a pull-up/down resistor, hopefully
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
21 pull-down.
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
22
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
23 nCS0 (C2): L1 trace to (4262,1016). On L2 it goes to two via points:
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
24 (4852,1016), an obvious larger via, and (4802,1000), a spot where a micro-via
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
25 back to L1 could hide. The micro-via back to L1 appears to be there indeed,
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
26 feeding an unmasked test point on the surface. Back to the main trace at
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
27 (4852,1016): there's something on L4 (might be a trace to another nearby via),
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
28 but maybe it's nothing, just a poor picture. Most likely nothing there, as
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
29 the same arrangement appears on L5 and L6, but clearly with no connection
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
30 between the two nearby vias. L7 is probably where the interesting connection
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
31 is, but the trace appears to have been scraped off in that spot in steve-m's
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
32 layer-grinding process.
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
33
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
34 Taking a different approach: let's start with the RAM/flash MCP on L8. Flash
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
35 CE1# goes to (4911,987); flash CE2# goes to (4954,660) and to an L8 test pad;
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
36 OE# goes to (4885,982); RAM CE1# goes to (4860,978). Of the two L2-L7 vias,
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
37 the upper one appears to be RAM, and the lower one appears to be flash.
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
38
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
39 Mistake found: I had earlier messed up trying to trace nCS0 on L2. Now it's
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
40 all clear: nCS0 goes to flash CE1#.
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
41
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
42 Now let's trace the RAM CS. From the upper L2-L7 via it goes on L2 to
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
43 (4800,1002) - already known to be a test point - and to (4212,978).
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
44 On L1 it goes to Calypso pin C3 - nCS1, just like on Leonardo.
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
45
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
46 Now let's trace flash CE2#. L7-L8 via at (4954,660); L2-L7 via at (4965,927);
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
47 on L2 it goes to (4210,930), on L1 it goes to Calypso ball D3.
b0f7481efc8b Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
48 That's nCS3.